Calendar coexistence. Free/busy lookup services between G Suite, Office 365 and Exchange

Transcription

1 Calendar coexistence Free/busy lookup services between G Suite, Office 365 and Exchange

2 Copyright 2017 CLOUDIWAY. All rights reserved. Use of any CLOUDIWAY solution is governed by the license agreement included in your original contract. The copyright and all other intellectual property rights in the Software are and remain the property of CLOUDIWAY and/or its subsidiaries ( CLOUDIWAY ). The licensee shall not acquire any title, copyright or other proprietary rights in the Software or any copy than specified in. You may not attempt to copy, modify, alter, disassemble, de-compile, translate or convert in human readable form, or reverse engineer all or any part of the Features and/or Data. You acknowledge that the Software and all related products (including but not limited to documentation) are the subject of copyright. You therefore, shall not during or any time after the expiry or termination of this Agreement, permit any act which infringes that copyright and, without limiting the generality of the foregoing, You specifically acknowledge that You may not copy the Software or Products except as otherwise expressly authorized by this Agreement. CLOUDIWAY provides this publication as is without warranty of any either express or implied, including but not limited to the implied warranties of merchantability or fitness for a particular purpose. CLOUDIWAY may revise this publication from time to time without notice. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions; therefore, this statement may not apply to you. Document history Date Editor Change details 01/09/2016 WR First publication 01/10/2016 WR Chapter content reordered, Exchange On-Premises steps added 16/01/2017 WR Exchange 2010/minimum requirements added + screendump updates 01/03/2017 WR Screendump updates, added 'Using this guide', updated table info Calendar coexistence admin guide Page i

3 Table of Contents 1 Free/busy calendar coexistence with Cloudiway Which systems can use free/busy calendar coexistence? Audience Using this guide Security during coexistence Configuration overview Set up Cloudiway for coexistence G Suite Before you start G Suite Create and set up a service account G Suite Set permissions for the service account G Suite Configure Cloudiway connector Office 365 Before you start Office 365 Configure Cloudiway connector Exchange On-Premises Before you start Exchange On-Premises Configure Cloudiway connector Set up a single user to test the connection Contact Cloudiway Configure remote system settings G Suite Enable the URI request in Cloudiway Office 365 Configure for coexistence Exchange On-Premises Configure for coexistence Test coexistence Force an update to the Office 365 global address list Testing Add users ready for go-live Import users via CSV file Appendix A: Troubleshooting Calendar coexistence admin guide Page ii

4 1 Free/busy calendar coexistence with Cloudiway Cloudiway's Free/busy calendar coexistence solution is ideal for company mergers, or for companies that require a long-term solution to interoperability. It's simple to set up and maintain. Cloudiway provides a cloud-based application that manages coexistence without requiring any software installation or overhead. Calendar coexistence manages cross-platform communication with no impact on the end user. It provides a seamless connection between vastly different remote systems, such as G Suite, Office 365 and Exchange. For example, a G Suite user can check the free/busy time of an Office 365 user using Google's standard calendar interface. Similarly, an Office 365 user on one domain can check the free/busy time of an Office 365 or G Suite user on an entirely different domain. To achieve this, each remote system needs to be configured to communicate with Cloudiway, including its own 'connector' on the Cloudiway platform. The connector allows queries to each system's free/busy data and a response, which Cloudiway then returns to the enquirer. For example, bob@warmsushi.com (using G Suite) wants to know if chloe@drypizza.com (using Office 365) is available for a meeting. Bob checks if Chloe is free by creating a meeting request. Behind the scenes, an availability query is sent to Cloudiway, which first checks for a connector for redfitness.com, then queries it for Chloe's availability. Cloudiway sends the query results back to Bob so that he can see if Chloe is available at the specified time. See the next page for more details. Calendar coexistence admin guide Page 1/31

5 Using Bob and Chloe's meeting as an example, Bob, opens his Google calendar and invites Chloe to a meeting, then clicks on the Find a Time tab to see her free/busy time. 1 The free/busy request is sent to G Suite 2 G Suite detects that Chloe is not a G Suite user, then sends the query to Cloudiway 3 Cloudiway finds the connector for Chloe's domain name (drypizza.com) and queries Office Office 365 looks up Chloe's free/busy calendar 5 Chloe's free/busy details are sent back to Office Office 365 sends the free/busy response to Cloudiway 7 Cloudiway sends the details to G Suite 8 G Suite updates the free/busy display for Chloe in Bob's meeting request Coexistence can also be used during mailbox migrations, which is covered in more detail elsewhere. Basically, during a migration with coexistence, end users can continue working without interruption. When a mailbox is migrated, address books are synchronized, mail is rerouted, and free/busy time is available at both the source of the migration and at the target. Calendar coexistence admin guide Page 2/31

6 1.1 Which systems can use free/busy calendar coexistence? Calendar free/busy coexistence can be implemented between two or more remote systems. Currently, the following systems are supported, including any combination and number of these: Office 365/Exchange Online; G Suite; and, Exchange On-Premises 2013 and later. If you are using Exchange On-Premises 2010 or any other system, please get in touch with our technical consultants at presales@cloudiway.com to discuss how coexistence can be implemented with your combination of remote systems. 1.2 Audience This guide is aimed at system administrators who are capable of connecting to remote systems such as Exchange Online and Office 365 Admin Panel. Coexistence is a detailed setup that requires a high level of competence and experience with PowerShell. Although we provide support for our own products, we do not provide support for third party products such as PowerShell or server administration of Google or Exchange. If you are concerned you might have any difficulty completing these steps, please consider a solution with our consulting team, contactable via sales@cloudiway.com. This will ensure a fast, costeffective and stress-free implementation. 1.3 Using this guide This guide covers three different types of connectors for enterprise coexistence: Office 365, Exchange On-Premises and G Suite. For clarity, this guide uses a different business name for each: Office 365: drypizza.com Exchange: coldburger.com G Suite: warmsushi.com The screen dumps used in this guide reflect these business names to provide typical examples of data to enter into each field. Calendar coexistence admin guide Page 3/31

7 2 Security during coexistence We take your privacy and security seriously at Cloudiway, and we have invested significant effort into making our platform and your data secure. Cloudiway provides a cloud-based application hosted in Windows Azure. It means that the software and data are centrally hosted and accessed by clients using a web browser and internet connection. In addition, Cloudiway's SaaS benefits from Windows Azure's certifications, ensuring security of the infrastructure, network and physical security layers of the Cloudiway cloud. For total assurance, Cloudiway provides auditing tools, secure, authenticated data connections and a logging system. More specifically: free/busy queries are performed in real time; Google and Office 365 free/busy queries are sent over HTTPS to the coexistence platform; calendar data are not stored internally: no cache is implemented; and, access to the coexistence platform is authenticated and logged. Calendar coexistence admin guide Page 4/31

8 3 Configuration overview There are four simple steps to configuring a remote system to coexist with another remote system: 1. set up the Cloudiway connectors; 2. contact Cloudiway to activate your connectors; 3. configure your remote system settings to enable communication; and, 4. test coexistence, add users and go live. Each Cloudiway connector requires a domain name as well as security credentials to allow two-way communication. G Suite also requires Service Account details ( and private key) before the connector can be saved. You can set up any remote system to coexist at any time. However, you must adhere to the order outlined in each section below to avoid coexistence being activated before all the required steps have been completed. NOTE: If you configure your remote systems prior to contacting Cloudiway, you risk being blacklisted by Google and/or Office 365. Calendar coexistence admin guide Page 5/31

9 4 Set up Cloudiway for coexistence 4.1 G Suite Before you start There are four simple steps to implementing coexistence with Google: enable the APIs in G Suite; set permissions for the Google service account; configure Cloudiway and G Suite communication; enable the URI request in Cloudiway. The steps should be completed in that order to ensure coexistence only begins when you're ready. Each step is explained thoroughly in the sections below. Before you start, ensure you have the details outlined in the following table. Name Description Location Cloudiway login Knowledge base access Cloudiway Consumer Key and Consumer Secret Your Cloudiway URL G Suite API console Google Admin console Standard Google user account Stores details and provides communication between the systems you already use. Our knowledge base is always accessible, with videos, samples, troubleshooting tools and more. These details are the unique identifiers associated with each of your systems. Cloudiway will assign a URL to use for coexistence (eg, coexistence.cloudiway.com). Required to enable APIs and to download the G Suite private key. This can be accessed via your Google Admin account. The Admin console is where administrators manage Google services for people in an organization. A standard G Suite user mailbox with no specific permissions accountsettings (or go to Account Settings from your username when you re logged into Cloudiway). Usually, this is coexistence.cloudiway.com, but for larger projects, you will be given a dedicated environment. Please contact Cloudiway for further details. Every free/busy lookup will be performed with the identity of this account. We recommend using freebusy@yoursite.com. Calendar coexistence admin guide Page 6/31

10 4.2 G Suite Create and set up a service account You can create a project in your G Suite service account, where you can enable APIs and create a project key. Cloudiway needs this key to open communication with G Suite. 1. In your browser, go to to launch the Google API manager 2. Click on Credentials on the left. If you already have a project, you can jump to step 4. If you don t have any projects set up, you will need to create one before you continue. 3. Click on the Create a project button, and add a meaningful name to Project name (such as Cloudiway ) and click the Create button A message might appear prompting you to create credentials. If it does, you can simply ignore it for now (we'll create them later). 4. Click on Library on the left to display a search bar for Google APIs 5. Type Google Calendar API and search for it (information about the API will be displayed) Calendar coexistence admin guide Page 7/31

11 6. Click on the ENABLE API link Once the API has been enabled (the link will change to display DISABLE): some other APIs might be automatically enabled (but only Google Calendar API is required for coexistence). You can check which APIs are activated by clicking on Dashboard on the left. 7. Click on Credentials on the left and from the Create credentials button, click on Service account key. The following screen will appear: 8. Click on New service account from the dropdown menu 9. Give the service account a recognizable name in Service account name (such as Cloudiway coexistence ), and leave Role blank (Cloudiway doesn t require this field) 10. Click on the P12 radio button Calendar coexistence admin guide Page 8/31

12 11. Click on the Create button The following message will appear: 12. Once you have read and understood the message (and take note of where the downloaded key is: you will need to upload it to Cloudiway later), click on the Close button 13. At the far right of the screen, click on the link for Manage service accounts 14. A list of service accounts will appear. Find the one with the name you just created, and click on the option dots ( ) on the far right, then select Edit 15. Tick the checkbox for Enable G Suite Domain-wide Delegation and type a product name into Product name for the consent screen, if prompted: 16. Click on the Save button Calendar coexistence admin guide Page 9/31

13 4.3 G Suite Set permissions for the service account After you ve created a service, you can use the Google Admin console to manage the service and its API calls. The following steps show you how to grant access permissions for the service account you created in the previous steps. 1. Ensure that you are still logged in to and from Service Accounts on the left, locate the Cloudiway coexistence service account 2. Copy the number displayed in Client ID 3. In a new browser tab, go to and login with your Admin console credentials 4. Click on Security, then Advanced settings (you might need to click on Show more to see this option) 5. Click on Manage API client access 6. Paste the number you copied into Client Name 7. Click in the One Or More API Scopes field and add the following 8. You can check that the scope was successfully registered by looking for its name next to the client ID you pasted Calendar coexistence admin guide Page 10/31

14 4.4 G Suite Configure Cloudiway connector For Cloudiway to successfully provide coexistence between two remote systems, it needs to store information from both in the form of the Cloudiway connector. You will need to set up a connector for each domain intended to coexist. Cloudiway will route all free/busy requests through a single user on your system. We recommend you create a new user specifically for this (for example, freebusy@yourdomain.com). You will need to add this address in the steps below. Follow the steps below to configure the G Suite side of communication with Cloudiway. 1. From your browser, go to and login 2. Click on Free/busy on the left, then Connectors 3. Click on the + New option at the bottom of the screen Calendar coexistence admin guide Page 11/31

15 4. Click on G Suite and type a meaningful name in Connector name 5. Click on the Create button 6. Type your source domain name (ie, the Google-enabled domain) in Domain Name Note: only free/busy times of users associated with this domain will be looked up: if you have more than one domain, you will need to create a connector for each domain. 7. Type the user login that will be used to query all free/busy time in Free/busy User Login 8. Paste your Service Account (you can copy it from the Manage service accounts screen from the project you created in 9. Upload the file that you downloaded earlier (it ends in.p12) to the Service Account Private Key field 10. Click the Save button at the bottom of the screen Calendar coexistence admin guide Page 12/31

16 4.5 Office 365 Before you start Before you start, you will need to ensure you have the details outlined in the following table. Name Description Location Cloudiway login Stores details and provides communication between the systems you already use. Cloudiway Consumer Key and Consumer Secret These details are the unique identifiers associated with each of your tenants. into Cloudiway.) Knowledge base access Office 365 login with admin access Windows PowerShell Office 365 standard user account Our extensive knowledge base is always accessible, with videos, troubleshooting tools, samples and more. Required later on to ensure an admin login has the Address Lists management role Required to access Exchange remotely to set up free/busy requests for resources (users and rooms). A standard Office 365 user created in the cloud with an Exchange license and no specific permissions. accountsettings (Or go to Account Settings from your username when you re logged Office 365 cloud login Every free/busy lookup will be performed with the identity of this account. We recommend using freebusy@yoursite.com. Calendar coexistence admin guide Page 13/31

17 4.6 Office 365 Configure Cloudiway connector For Cloudiway to successfully provide coexistence between Office 365 and another tenant, it needs information from both products. You will need to set up a connector for each domain intended to coexist. Follow the steps below to configure the Office 365 side of communication with Cloudiway. Below, we will use the Office 365 standard user account mentioned in the table above. 1. From your browser, go to and login 2. Click on Coexistence Server on the left, then Connectors 3. Click on the + New option at the bottom of the screen Calendar coexistence admin guide Page 14/31

18 4. Click on Office 365 and type a meaningful name in Connector name 5. Click on the Create button 6. Type your source domain name (ie, the Office 365-enabled domain) in Domain Name 7. Type the user login that will be used to query all free/busy time in Free/busy User Login and fill in the password fields 8. Click on the Save button Calendar coexistence admin guide Page 15/31

19 4.7 Exchange On-Premises Before you start Cloudiway is currently configured to work with Exchange On-Premises 2013 and later only. If you're using Exchange 2010, please get in touch via Our technical consultants will be able to discuss your plan and advise you on additional setup requirements that we can undertake on your behalf. Before you start, Ensure you have the details outlined in the following table. Name Description Location Cloudiway login Stores details and provides communication between the systems you already use. Cloudiway Consumer Key and Consumer Secret These details are the unique identifiers associated with each of your tenants. into Cloudiway.) Knowledge base access Exchange standard user account Port requirements Our extensive knowledge base is always accessible, with videos, troubleshooting tools, samples and more. A standard Exchange user with no specific permissions. The Cloudiway platform needs to connect to Exchange On-Premises securely. accountsettings (Or go to Account Settings from your username when you re logged Every free/busy lookup will be performed with the identity of this account. We recommend using freebusy@yoursite.com. Use SSL port 443. Calendar coexistence admin guide Page 16/31

20 4.8 Exchange On-Premises Configure Cloudiway connector For Cloudiway to successfully provide coexistence between Exchange On-Premises and another tenant, it needs information from both products. You will need to set up a connector for each domain intended to coexist. Follow the steps below to configure the Exchange On-Premises side of communication with Cloudiway. Below, we will use the Exchange On-Premises standard user account mentioned in the table above. 1. From your browser, go to and login 2. Click on Coexistence Server on the left, then Connectors 3. Click on the + New option at the bottom of the screen Calendar coexistence admin guide Page 17/31

21 4. Click on Exchange and type a meaningful name in Connector name 5. Click on the Create button 6. Type your source domain name in Domain Name and the Exchange server name in Server Name 7. Type the user login that will be used to query all free/busy time in Free/busy User Login and fill in the password fields 8. Click on the Save button Calendar coexistence admin guide Page 18/31

22 4.9 Set up a single user to test the connection Before Cloudiway can activate coexistence for all your users, we will ask you to test your connectors with some test users. This is a simple task involving a single user associated with each of your connectors (so, a minimum of two individual users). Make sure you have the login credentials for each of your test users. Please note that any further configuration steps you take after creating your test users may cause you to be blacklisted by Google or Office 365, so please follow the steps below and then contact Cloudiway to confirm you're ready to test coexistence. Your Cloudiway contact will be in touch after checking over your configuration, and will ask you to complete the coexistence testing prior to final activation. 1. In your browser, ensure you are logged in to 2. Click on the Coexistence menu option on the left, then User list 3. At the bottom of screen, click on User, then select Single User 4. Type an existing user from one of your remote systems in User Calendar coexistence admin guide Page 19/31

23 5. From the Source dropdown, select the connector/remote system that the user is associated with 6. Click on the Create button A message will confirm the creation of your user: 7. Repeat the above steps so that each of your connectors has an associated user. Calendar coexistence admin guide Page 20/31

24 5 Contact Cloudiway Now that you've set up your connectors and test users, you should contact Cloudiway to activate your account and your coexistence. Contact to request activation. Cloudiway will come back to you with information relating to the Cloudiway server URL that you will need to use in the following steps. Once you've heard back from us, we'll work with you to test your connectors, then activate coexistence. Please note that further configuration at this stage may lead to you being blacklisted on Google and/or Office 365. Calendar coexistence admin guide Page 21/31

25 6 Configure remote system settings Once you have heard back from Cloudiway to confirm that your connectors are activated, you can activate your remote systems for coexistence. As soon as the steps below are performed, Cloudiway can complete the configuration so that communication can begin. 6.1 G Suite Enable the URI request in Cloudiway For G Suite coexistence to work, you need to enable the URI request in Cloudiway. You will also need the Cloudiway URL that has been assigned to you. 1. In your browser, ensure you are logged in to 2. Find your name in the top right corner of the screen and select Account Settings (you will need to copy and paste the fields for Consumer Key and Consumer Secret into G Suite) 3. In a new browser tab, ensure you are logged in to and from the Home page, click on Apps, then G Suite, then Calendar 4. Scroll down and click on Calendar interop management 5. On the empty line below Exchange Web Services URL, type your Cloudiway URL (below is an example for drypizza.com that will not match what you have been given: please use the URL that Cloudiway has assigned to you): Calendar coexistence admin guide Page 22/31

26 6. On the empty line below Exchange Role Account, enter your Cloudiway Consumer Key 7. Click on Enter Password and paste your Cloudiway Consumer Secret 8. Ensure that the checkbox for Enable Server Version of Free Busy Sync is checked 9. Click on Save Changes to complete the process 6.2 Office 365 Configure for coexistence The configuration of free/busy requests requires an availability address space. The 'add availability address space' command instructs Office 365 to forward free/busy requests to the Cloudiway platform. In the steps below, we will create an availability address space. In order to create an availability address space, an availability config must exist. The Cloudiway platform doesn't use this config in any way, but this is required to run the commands. To connect to your Exchange Online server, you will need to have a basic working knowledge of Windows PowerShell. 1. Launch Windows PowerShell and connect to Exchange Online: you can download a script to connect here: 2. Before you can create an availability address, you must run the following command at least once New-AvailabilityConfig -OrgWideAccount limiteduser@company.com (where limiteduser@company.com is whatever address on your Exchange server that you want; the Cloudiway platform won't use this account) Calendar coexistence admin guide Page 23/31

27 The script will output something similar to the text below: 3. Copy the commands below (also available online at $admincredsid = "\consumerkey" $admincredspassword = "consumersecret" $securepassword = ConvertTo-SecureString $admincredspassword - AsPlainText -Force $admincreds = New-Object System.Management.Automation.PSCredential($adminCredsId,$secure Password) Add-AvailabilityAddressSpace -AccessMethod OrgWideFB - ForestName domainname.com -Credentials $admincreds - TargetAutodiscoverEpr ' 4. Paste the commands into PowerShell, ensuring you have updated the following with your own values: \consumerkey (your Cloudiway consumer key, with a slash before the key) consumersecret (your Cloudiway consumer secret) domainname.com (your destination domain where free/busy time is to be added) xxx.cloudiway.com (the server name provided by Cloudiway) If you receive any error messages, check TechNet online (eg, for more details. If you still need further help, please consider a solution with our consulting team, contactable via sales@cloudiway.com. Calendar coexistence admin guide Page 24/31

28 6.3 Exchange On-Premises Configure for coexistence The steps below work only for Exchange On-Premises 2013 and later. If you have Exchange On- Premises 2010, please get in touch to discuss calendar free/busy coexistence implementation. 1. Launch Exchange Management Shell to connect to your Exchange server 2. Copy the commands below (also available online at $admincredsid = "\consumerkey" $admincredspassword = "consumersecret" $securepassword = ConvertTo-SecureString $admincredspassword - AsPlainText -Force $admincreds = New-Object System.Management.Automation.PSCredential($adminCredsId,$secure Password) Add-AvailabilityAddressSpace -AccessMethod OrgWideFB - ForestName domainname.com -Credentials $admincreds - TargetAutodiscoverEpr ' 3. Paste the commands into PowerShell, ensuring you have updated the following with your own values: \consumerkey (your Cloudiway consumer key, with a slash before the key) consumersecret (your Cloudiway consumer secret) domainname.com (domain where you'd like the free/busy time to be added) xxx.cloudiway.com (the server name provided by Cloudiway) (The Add-AvailabilityAddressSpace command tells Office 365 and Exchange to forward its free/busy requests for the remote domain to the Cloudiway server.) If you receive any error messages, check TechNet online (eg: for more details. If you still need further help, please consider a solution with our consulting team, contactable via presales@cloudiway.com. NOTE: If you use a proxy server with Exchange On-Premises 2010 or 2013, please get in touch with our consulting team to heck and resolve any conflicts. Calendar coexistence admin guide Page 25/31

29 7 Test coexistence 7.1 Force an update to the Office 365 global address list Office 365 and Exchange can only query the free/busy time of objects that already exist in the global address book. In order to test the free/busy time of the remote system of Office/Exchange, you must: create a test contact from the other remote system (eg, G Suite) in the Office 365 address book; assign an Address Lists management role to an admin user; and, manually force an update to the address book using PowerShell. The test contact must match the test user that you created for the other connector in section 4.9. Make sure you use the right test user (ie, the one that doesn't already exist in your global address list). 1. Create the test user in your Exchange/Office 365 global address list 2. Login to the Office 365 portal with your administrator account 3. Go to the Exchange admin center, then click on permissions and the admin roles 4. Click on the plus sign (+) to create a new role Calendar coexistence admin guide Page 26/31

30 5. Give your group a name and assign it the role of Address Lists, then add an admin user to the group: 6. Click on the Save button to save your group 7. Open PowerShell and use the following commands to login to Exchange Online $UserCredential = Get-Credential $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri -Credential $UserCredential -Authentication Basic - AllowRedirection Import-PSSession $Session 8. Run the command get-addresslist and verify that it s working 9. Run the command Set-AddressList -Identity "All users" 10. Check that the global address list now contains the test user Calendar coexistence admin guide Page 27/31

31 7.2 Testing At this point, your system configuration is complete and you're ready to test coexistence with your test users. To test, login to each of your source systems with your test user credentials (for each test user you set up in section 4.7 and open each test user's calendar. Verify that each test user can see the other's free/busy time. You should be able to see free/busy time in both directions. Calendar coexistence admin guide Page 28/31

32 8 Add users ready for go-live Once you're satisfied that coexistence is working as expected, you can import your remaining users and go live. 8.1 Import users via CSV file The easiest way to import all your users is via CSV upload. The Cloudiway platform provides an interface for CSV uploads. The CSV file needs just two columns: User ;SourceName where SourceName matches the name of the corresponding Cloudiway connector for each user. 1. On the Coexistence area of the Cloudiway platform, click on User list Calendar coexistence admin guide Page 29/31

33 2. At the bottom of screen, click on User, then select Upload CSV 3. If required, click on Download sample CSV and add your users to the CSV file using the sample headers (User ;SourceName) 4. When you have a complete CSV file with the correct headers, click on the Upload button 5. Locate your CSV file within your own file system, and double-click on it to select it The Cloudiway platform will process your CSV file. You can check the status of each connector by clicking on the Run sub-menu on the Cloudiway platform. Red bars indicate a connector is not active and green indicates it is. Remember, Office 365 and Exchange can only query free/busy time of objects that already exist in its global address book. Calendar coexistence admin guide Page 30/31

34 Appendix A: Troubleshooting Cloudiway provides an extensive knowledge base with many resources, including common error messages, video guides and downloads. Please visit the coexistence knowledge base area here: Please visit the entire knowledge base here (where you can search for keywords or read through topics): The knowledge base also contains information on how you can ask for further support, should you require it. Calendar coexistence admin guide Page 31/31